Answer in brief
CVE-2026-54625 records a Medium severity (CVSS 4.8) vulnerability in django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning). The current sources do not mark it as known exploited. The current feed maps django-cms/django-cms (generic), django-cms (pip), django-cms (pypi). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 4.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps django-cms/django-cms (generic), django-cms (pip), django-cms (pypi). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| django-cms/django-cmsgeneric | <5.0.8 || >=5.1.0a1 <5.1.0 | 5.0.8, 5.1.0 |
| django-cmspip | <5.0.8 | 5.0.8 |
| django-cmspypi | >=0 <5.0.8 | 5.0.8 |
Published upstream
Aug 20, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 20, 2026
django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although set_page_cache adds those names to the response Vary header, get_page_cache retrieves the first stored variant under the same header-agnostic key. When CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor’s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0.
Quoted source text, attributed separately from HOL analysis.